@useatlas/create 0.0.1

package/templates/docker/src/api/routes/conversations.ts

@@ -0,0 +1,266 @@
+/**
+ * Conversations REST routes — list, get, and delete conversations.
+ *
+ * Middleware stack follows the same auth → rate limit → withRequestContext
+ * pattern as chat.ts and query.ts.
+ */
+
+import { Hono } from "hono";
+import { z } from "zod";
+import { createLogger, withRequestContext } from "@atlas/api/lib/logger";
+import type { AuthResult } from "@atlas/api/lib/auth/types";
+import {
+  authenticateRequest,
+  checkRateLimit,
+  getClientIP,
+} from "@atlas/api/lib/auth/middleware";
+import { hasInternalDB } from "@atlas/api/lib/db/internal";
+import {
+  listConversations,
+  getConversation,
+  deleteConversation,
+  starConversation,
+  type CrudFailReason,
+} from "@atlas/api/lib/conversations";
+
+const log = createLogger("conversations");
+
+// ---------------------------------------------------------------------------
+// Zod schemas — exported for OpenAPI spec generation
+// ---------------------------------------------------------------------------
+
+export const ConversationSchema = z.object({
+  id: z.string().uuid(),
+  userId: z.string().nullable(),
+  title: z.string().nullable(),
+  surface: z.enum(["web", "api", "mcp", "slack"]),
+  connectionId: z.string().nullable(),
+  starred: z.boolean(),
+  createdAt: z.string().datetime(),
+  updatedAt: z.string().datetime(),
+});
+
+export const StarConversationBodySchema = z.object({
+  starred: z.boolean(),
+});
+
+export const MessageSchema = z.object({
+  id: z.string().uuid(),
+  conversationId: z.string().uuid(),
+  role: z.enum(["user", "assistant", "system", "tool"]),
+  content: z.unknown(),
+  createdAt: z.string().datetime(),
+});
+
+export const ConversationWithMessagesSchema = ConversationSchema.extend({
+  messages: z.array(MessageSchema),
+});
+
+export const ListConversationsResponseSchema = z.object({
+  conversations: z.array(ConversationSchema),
+  total: z.number().int().nonnegative(),
+});
+
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+/** Map a CrudFailReason to { body, status } for JSON responses. */
+function crudFailResponse(reason: CrudFailReason) {
+  switch (reason) {
+    case "no_db":
+      return { body: { error: "not_available", message: "Conversation history is not available (no internal database configured)." }, status: 404 as const };
+    case "not_found":
+      return { body: { error: "not_found", message: "Conversation not found." }, status: 404 as const };
+    case "error":
+      return { body: { error: "internal_error", message: "A database error occurred. Please try again." }, status: 500 as const };
+    default: {
+      const _exhaustive: never = reason;
+      return { body: { error: "internal_error", message: `Unexpected failure: ${_exhaustive}` }, status: 500 as const };
+    }
+  }
+}
+
+const conversations = new Hono();
+
+// ---------------------------------------------------------------------------
+// Shared auth + rate-limit preamble
+// ---------------------------------------------------------------------------
+
+async function authPreamble(req: Request, requestId: string) {
+  let authResult: AuthResult;
+  try {
+    authResult = await authenticateRequest(req);
+  } catch (err) {
+    log.error(
+      { err: err instanceof Error ? err : new Error(String(err)), requestId },
+      "Auth dispatch failed",
+    );
+    return { error: { error: "auth_error", message: "Authentication system error" }, status: 500 as const };
+  }
+  if (!authResult.authenticated) {
+    log.warn({ requestId, status: authResult.status }, "Authentication failed");
+    return { error: { error: "auth_error", message: authResult.error }, status: authResult.status as 401 | 403 | 500 };
+  }
+
+  const ip = getClientIP(req);
+  const rateLimitKey = authResult.user?.id ?? (ip ? `ip:${ip}` : "anon");
+  const rateCheck = checkRateLimit(rateLimitKey);
+  if (!rateCheck.allowed) {
+    const retryAfterSeconds = Math.ceil((rateCheck.retryAfterMs ?? 60000) / 1000);
+    return {
+      error: { error: "rate_limited", message: "Too many requests. Please wait before trying again.", retryAfterSeconds },
+      status: 429 as const,
+      headers: { "Retry-After": String(retryAfterSeconds) },
+    };
+  }
+
+  return { authResult };
+}
+
+// ---------------------------------------------------------------------------
+// GET / — list conversations
+// ---------------------------------------------------------------------------
+
+conversations.get("/", async (c) => {
+  const req = c.req.raw;
+  const requestId = crypto.randomUUID();
+
+  if (!hasInternalDB()) {
+    return c.json({ error: "not_available", message: "Conversation history is not available (no internal database configured)." }, 404);
+  }
+
+  const preamble = await authPreamble(req, requestId);
+  if ("error" in preamble) {
+    return c.json(preamble.error, { status: preamble.status, headers: preamble.headers });
+  }
+  const { authResult } = preamble;
+
+  return withRequestContext({ requestId, user: authResult.user }, async () => {
+    const rawLimit = parseInt(c.req.query("limit") ?? "20", 10);
+    const rawOffset = parseInt(c.req.query("offset") ?? "0", 10);
+    const limit = Number.isFinite(rawLimit) && rawLimit > 0 ? Math.min(rawLimit, 100) : 20;
+    const offset = Number.isFinite(rawOffset) && rawOffset >= 0 ? rawOffset : 0;
+    const starredParam = c.req.query("starred");
+    const starred = starredParam === "true" ? true : starredParam === "false" ? false : undefined;
+    const result = await listConversations({
+      userId: authResult.user?.id,
+      starred,
+      limit,
+      offset,
+    });
+    return c.json(result);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// GET /:id — get conversation with messages
+// ---------------------------------------------------------------------------
+
+conversations.get("/:id", async (c) => {
+  const req = c.req.raw;
+  const requestId = crypto.randomUUID();
+
+  if (!hasInternalDB()) {
+    return c.json({ error: "not_available", message: "Conversation history is not available (no internal database configured)." }, 404);
+  }
+
+  const preamble = await authPreamble(req, requestId);
+  if ("error" in preamble) {
+    return c.json(preamble.error, { status: preamble.status, headers: preamble.headers });
+  }
+  const { authResult } = preamble;
+
+  const id = c.req.param("id");
+  if (!UUID_RE.test(id)) {
+    return c.json({ error: "invalid_request", message: "Invalid conversation ID format." }, 400);
+  }
+
+  return withRequestContext({ requestId, user: authResult.user }, async () => {
+    const result = await getConversation(id, authResult.user?.id);
+    if (!result.ok) {
+      const fail = crudFailResponse(result.reason);
+      return c.json(fail.body, fail.status);
+    }
+    return c.json(result.data);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// PATCH /:id/star — star or unstar a conversation
+// ---------------------------------------------------------------------------
+
+conversations.patch("/:id/star", async (c) => {
+  const req = c.req.raw;
+  const requestId = crypto.randomUUID();
+
+  if (!hasInternalDB()) {
+    return c.json({ error: "not_available", message: "Conversation history is not available (no internal database configured)." }, 404);
+  }
+
+  const preamble = await authPreamble(req, requestId);
+  if ("error" in preamble) {
+    return c.json(preamble.error, { status: preamble.status, headers: preamble.headers });
+  }
+  const { authResult } = preamble;
+
+  const id = c.req.param("id");
+  if (!UUID_RE.test(id)) {
+    return c.json({ error: "invalid_request", message: "Invalid conversation ID format." }, 400);
+  }
+
+  return withRequestContext({ requestId, user: authResult.user }, async () => {
+    let body: unknown;
+    try {
+      body = await req.json();
+    } catch (err) {
+      log.debug({ err: err instanceof Error ? err.message : String(err) }, "Invalid JSON body in PATCH star");
+      return c.json({ error: "invalid_request", message: "Invalid JSON body." }, 400);
+    }
+
+    const parsed = StarConversationBodySchema.safeParse(body);
+    if (!parsed.success) {
+      return c.json({ error: "invalid_request", message: "Body must contain { starred: boolean }." }, 400);
+    }
+
+    const result = await starConversation(id, parsed.data.starred, authResult.user?.id);
+    if (!result.ok) {
+      const fail = crudFailResponse(result.reason);
+      return c.json(fail.body, fail.status);
+    }
+    return c.json({ id, starred: parsed.data.starred });
+  });
+});
+
+// ---------------------------------------------------------------------------
+// DELETE /:id — delete conversation
+// ---------------------------------------------------------------------------
+
+conversations.delete("/:id", async (c) => {
+  const req = c.req.raw;
+  const requestId = crypto.randomUUID();
+
+  if (!hasInternalDB()) {
+    return c.json({ error: "not_available", message: "Conversation history is not available (no internal database configured)." }, 404);
+  }
+
+  const preamble = await authPreamble(req, requestId);
+  if ("error" in preamble) {
+    return c.json(preamble.error, { status: preamble.status, headers: preamble.headers });
+  }
+  const { authResult } = preamble;
+
+  const id = c.req.param("id");
+  if (!UUID_RE.test(id)) {
+    return c.json({ error: "invalid_request", message: "Invalid conversation ID format." }, 400);
+  }
+
+  return withRequestContext({ requestId, user: authResult.user }, async () => {
+    const result = await deleteConversation(id, authResult.user?.id);
+    if (!result.ok) {
+      const fail = crudFailResponse(result.reason);
+      return c.json(fail.body, fail.status);
+    }
+    return c.body(null, 204);
+  });
+});
+
+export { conversations };

package/templates/docker/src/api/routes/health.ts

@@ -0,0 +1,287 @@
+/**
+ * Health check route — public, no auth.
+ *
+ * Probes datasource, internal DB, semantic layer, explore backend,
+ * and auth mode.
+ */
+
+import { Hono } from "hono";
+import { z } from "zod";
+import {
+  validateEnvironment,
+  getStartupWarnings,
+  type DiagnosticError,
+} from "@atlas/api/lib/startup";
+import { getWhitelistedTables } from "@atlas/api/lib/semantic";
+import { createLogger } from "@atlas/api/lib/logger";
+import { getExploreBackendType, getActiveSandboxPluginId } from "@atlas/api/lib/tools/explore";
+import { detectAuthMode } from "@atlas/api/lib/auth/detect";
+import { SENSITIVE_PATTERNS } from "@atlas/api/lib/security";
+
+const log = createLogger("health");
+
+// ---------------------------------------------------------------------------
+// Zod schemas — exported for OpenAPI spec generation
+// ---------------------------------------------------------------------------
+
+const CheckStatusSchema = z.enum(["ok", "error", "not_configured"]);
+
+export const HealthResponseSchema = z.object({
+  status: z.enum(["ok", "degraded", "error"]),
+  warnings: z.array(z.string()).optional(),
+  checks: z.object({
+    datasource: z.object({
+      status: CheckStatusSchema,
+      latencyMs: z.number().int().nonnegative().optional(),
+      error: z.string().optional(),
+    }),
+    provider: z.object({
+      status: z.enum(["ok", "error"]),
+      provider: z.string(),
+      model: z.string(),
+      error: z.string().optional(),
+    }),
+    semanticLayer: z.object({
+      status: z.enum(["ok", "error"]),
+      entityCount: z.number().int().nonnegative(),
+      error: z.string().optional(),
+    }),
+    internalDb: z.object({
+      status: CheckStatusSchema,
+      latencyMs: z.number().int().nonnegative().optional(),
+      error: z.string().optional(),
+    }),
+    explore: z.object({
+      backend: z.enum(["nsjail", "sidecar", "vercel-sandbox", "just-bash", "plugin"]),
+      isolated: z.boolean(),
+      isolationVerified: z.boolean().optional(),
+      pluginId: z.string().optional(),
+    }),
+    auth: z.object({
+      mode: z.enum(["none", "simple-key", "managed", "byot"]),
+      enabled: z.boolean(),
+      error: z.string().optional(),
+    }),
+    slack: z.object({
+      enabled: z.boolean(),
+      mode: z.enum(["disabled", "single-workspace", "oauth"]),
+    }),
+  }),
+  sources: z.record(z.string(), z.object({
+    status: z.enum(["healthy", "degraded", "unhealthy", "unknown"]),
+    latencyMs: z.number().int().nonnegative().optional(),
+    message: z.string().optional(),
+    checkedAt: z.string().optional(),
+    dbType: z.string(),
+  })).optional(),
+});
+
+function findDiagnostic(
+  diagnostics: DiagnosticError[],
+  ...codes: DiagnosticError["code"][]
+): DiagnosticError | undefined {
+  return diagnostics.find((d) => codes.includes(d.code));
+}
+
+const health = new Hono();
+
+health.get("/", async (c) => {
+  try {
+    const diagnostics = await validateEnvironment();
+
+    // Probe datasource with SELECT 1 — this is the authoritative real-time check.
+    // Check both the env var and the ConnectionRegistry (a default datasource may
+    // be configured via atlas.config.ts without ATLAS_DATASOURCE_URL).
+    let dsLatencyMs: number | undefined;
+    let dsProbeError: string | undefined;
+    const { connections: connRegistry2, detectDBType, getDB } = await import("@atlas/api/lib/db/connection");
+    const hasDatasource = !!process.env.ATLAS_DATASOURCE_URL || connRegistry2.list().includes("default");
+    if (hasDatasource) {
+      try {
+        const dbType = detectDBType();
+
+        if (dbType === "salesforce") {
+          const { getSalesforceSource, listSalesforceSources } = await import("@atlas/api/lib/db/salesforce");
+          const sourceId = listSalesforceSources()[0] ?? "default";
+          const start = performance.now();
+          await getSalesforceSource(sourceId).listObjects();
+          dsLatencyMs = Math.round(performance.now() - start);
+        } else {
+          const start = performance.now();
+          await getDB().query("SELECT 1", 5000);
+          dsLatencyMs = Math.round(performance.now() - start);
+        }
+      } catch (err) {
+        log.error(
+          { err: err instanceof Error ? err : new Error(String(err)) },
+          "Health check datasource probe failed",
+        );
+        dsProbeError = "Datasource query failed";
+      }
+    }
+
+    // Probe internal DB with SELECT 1
+    let internalLatencyMs: number | undefined;
+    let internalProbeError: string | undefined;
+    if (process.env.DATABASE_URL) {
+      try {
+        const { getInternalDB } = await import("@atlas/api/lib/db/internal");
+        const pool = getInternalDB();
+        const start = performance.now();
+        await pool.query("SELECT 1");
+        internalLatencyMs = Math.round(performance.now() - start);
+      } catch (err) {
+        log.error(
+          { err: err instanceof Error ? err : new Error(String(err)) },
+          "Health check internal DB probe failed",
+        );
+        internalProbeError = "Internal DB query failed";
+      }
+    }
+
+    const provider = process.env.ATLAS_PROVIDER ?? "anthropic";
+    const entityCount = getWhitelistedTables().size;
+    const exploreBackend = getExploreBackendType();
+    const authMode = detectAuthMode();
+
+    // Datasource is unhealthy if: no URL, diagnostics flagged it, OR the live probe failed
+    const dsDiagnostic = findDiagnostic(
+      diagnostics,
+      "MISSING_DATASOURCE_URL",
+      "DB_UNREACHABLE",
+    );
+    const hasDsError = !!dsDiagnostic || !!dsProbeError;
+    const dsNotConfigured = !hasDatasource;
+    const hasKeyError = !!findDiagnostic(diagnostics, "MISSING_API_KEY");
+    const hasSemanticError = !!findDiagnostic(
+      diagnostics,
+      "MISSING_SEMANTIC_LAYER",
+    );
+    const hasInternalDbError =
+      !!findDiagnostic(diagnostics, "INTERNAL_DB_UNREACHABLE") ||
+      !!internalProbeError;
+    const authDiagnostic = findDiagnostic(
+      diagnostics,
+      "WEAK_AUTH_SECRET",
+      "INVALID_JWKS_URL",
+      "MISSING_AUTH_ISSUER",
+    );
+    const hasAuthError = !!authDiagnostic;
+
+    let status: "ok" | "degraded" | "error";
+    if (hasDsError && !dsNotConfigured) status = "error";
+    else if (
+      dsNotConfigured ||
+      hasKeyError ||
+      hasSemanticError ||
+      hasInternalDbError ||
+      hasAuthError
+    )
+      status = "degraded";
+    else status = "ok";
+
+    const warnings = getStartupWarnings();
+
+    // Per-source health from ConnectionRegistry
+    let sourcesSection: Record<string, { status: string; latencyMs?: number; message?: string; checkedAt?: string; dbType: string }> | undefined;
+    try {
+      const connMeta = connRegistry2.describe();
+      if (connMeta.length > 0) {
+        sourcesSection = {};
+        for (const meta of connMeta) {
+          const h = meta.health;
+          // Scrub health messages that might contain connection credentials or internal state
+          const safeMessage = h?.message && !SENSITIVE_PATTERNS.test(h.message)
+            ? h.message
+            : h?.message ? "Health check failed — check server logs for details." : undefined;
+          sourcesSection[meta.id] = {
+            status: h?.status ?? "unknown",
+            ...(h?.latencyMs !== undefined ? { latencyMs: h.latencyMs } : {}),
+            ...(safeMessage ? { message: safeMessage } : {}),
+            ...(h?.checkedAt ? { checkedAt: h.checkedAt.toISOString() } : {}),
+            dbType: meta.dbType,
+          };
+        }
+
+        // Promote overall status based on source health
+        const hasUnhealthy = connMeta.some((m) => m.health?.status === "unhealthy");
+        const hasDegraded = connMeta.some((m) => m.health?.status === "degraded");
+        if (hasUnhealthy && status !== "error") status = "error";
+        else if (hasDegraded && status === "ok") status = "degraded";
+      }
+    } catch (err) {
+      log.warn(
+        { err: err instanceof Error ? err.message : String(err) },
+        "Failed to collect per-source health — sources section omitted",
+      );
+    }
+
+    const response = {
+      status,
+      ...(warnings.length > 0 && { warnings }),
+      checks: {
+        datasource: dsNotConfigured
+          ? { status: "not_configured" as const }
+          : {
+              status: hasDsError ? "error" : "ok",
+              ...(dsLatencyMs !== undefined && { latencyMs: dsLatencyMs }),
+              ...(hasDsError && {
+                error: dsProbeError ?? dsDiagnostic?.code ?? "DB_UNREACHABLE",
+              }),
+            },
+        provider: {
+          status: hasKeyError ? "error" : "ok",
+          provider,
+          model: process.env.ATLAS_MODEL ?? "(default)",
+          ...(hasKeyError && { error: "MISSING_API_KEY" }),
+        },
+        semanticLayer: {
+          status: hasSemanticError ? "error" : "ok",
+          entityCount,
+          ...(hasSemanticError && { error: "MISSING_SEMANTIC_LAYER" }),
+        },
+        internalDb: !process.env.DATABASE_URL
+          ? { status: "not_configured" as const }
+          : {
+              status: hasInternalDbError ? "error" : "ok",
+              ...(internalLatencyMs !== undefined && {
+                latencyMs: internalLatencyMs,
+              }),
+              ...(hasInternalDbError && {
+                error: internalProbeError ?? "INTERNAL_DB_UNREACHABLE",
+              }),
+            },
+        explore: {
+          backend: exploreBackend,
+          isolated: exploreBackend !== "just-bash",
+          ...(exploreBackend === "plugin" && { isolationVerified: false }),
+          ...(exploreBackend === "plugin" && getActiveSandboxPluginId() ? { pluginId: getActiveSandboxPluginId() } : {}),
+        },
+        auth: {
+          mode: authMode,
+          enabled: authMode !== "none",
+          ...(hasAuthError && { error: authDiagnostic!.code }),
+        },
+        slack: {
+          enabled: !!process.env.SLACK_SIGNING_SECRET,
+          mode: !process.env.SLACK_SIGNING_SECRET
+            ? ("disabled" as const)
+            : process.env.SLACK_CLIENT_ID
+              ? ("oauth" as const)
+              : ("single-workspace" as const),
+        },
+      },
+      ...(sourcesSection ? { sources: sourcesSection } : {}),
+    };
+
+    return c.json(response, response.status === "error" ? 503 : 200);
+  } catch (err) {
+    log.error(
+      { err: err instanceof Error ? err : new Error(String(err)) },
+      "Health endpoint unexpected error",
+    );
+    return c.json({ status: "error", error: "health_check_failed" }, 503);
+  }
+});
+
+export { health };